CVE-2026-111146 Details
Description
ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in MAPIPrint() that allows attackers to read past heap allocations by supplying compressed RTF properties. Attackers can deliver a crafted winmail.dat whose decompressed RTF lacks a NUL terminator, causing printf to over-read, crashing ytnefprint and leaking adjacent heap bytes.
A heap out-of-bounds read vulnerability has been identified in the 'ytnef' tool, specifically in versions through 2.1.2. The issue arises within the 'MAPIPrint()' function of the 'libytnef' library, which handles TNEF 'winmail.dat' email attachments. The vulnerability allows attackers to read beyond allocated heap memory by supplying crafted RTF properties that lack proper termination. This exploitation can lead to crashes of the 'ytnefprint' tool and unauthorized leakage of adjacent heap data.
To address this vulnerability, the 'DecompressRTF' function should be modified to validate the 'uncompressedSize' field against the actual size of the input data before performing any memory operations. Furthermore, the function should ensure that the returned buffer is properly null-terminated. The 'MAPIPrint' function should also be updated to print decompressed RTF data using length-aware logic, rather than as a C string.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Yeraze/ytnef | [email protected] | ProductSource CodeVendor |
| https://github.com/Yeraze/ytnef/blob/d9f089144414d3b0912c29ab96f8f1c591d00319/lib/ytnef.c#L1449-L1458 | [email protected] | Source CodeVendor |
| https://github.com/Yeraze/ytnef/blob/d9f089144414d3b0912c29ab96f8f1c591d00319/lib/ytnef.c#L1605-L1614 | [email protected] | Source CodeVendor |
| https://github.com/Yeraze/ytnef/issues/112 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://hackmd.io/@haind-pwn/ytnef-decompressrtf-oob-read | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/ytnef-through-2.1.2-heap-out-of-bounds-read-via-mapiprint-in-lib-ytnef-c | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Yeraze ytnef | <= 2.1.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |